Privacy & Data Protection / Cybersecurity

Services

Mexico has a robust regulatory framework governing the processing of personal data, as well as a regulatory authority with binding powers to enforce compliance with applicable data protection laws. Mexico is also a signatory to Convention 108 of the Council of Europe for the Protection of Individuals with regard to Automatic Processing of Personal Data, as well as its Additional Protocol concerning Supervisory Authorities and Transborder Data Flows.

Our Privacy practice primarily focuses on providing specialized legal counsel regarding the protection, management, and processing of personal data and sensitive personal data for controllers and regulated entities in Mexico. We draft and assist controllers and regulated entities in implementing tailored privacy policies specifically designed to meet their operational and regulatory needs.

We conduct gap analyses, data transfer impact assessments, document personal data transfer processes, and prepare contractual clauses related to the handling of personal and sensitive personal data in accordance with the policies of controllers / regulated entities and applicable Mexican legislation.

Our Privacy practice encompasses multiple aspects of data protection law, with a particular focus on the following services:

1. Preparation and drafting of privacy notices.
2. Development and training for the implementation of personal data protection policies and confidential information management procedures.
3. Development of guidelines for the implementation of privacy notices and personal data handling processes.
4. Assistance in responding to ARCO rights requests.
5. Filing of ARCO rights requests.
6. Representation in ARCO rights proceedings before the competent authority.
7. Litigation related to compliance with ARCO rights requests.
8. Filing of complaints before the competent authority.
9. Filing of administrative review remedies before the authority.
10. Preparation and negotiation of agreements involving transfers of personal data.
11. Filing of public information access requests.
12. Assistance in responding to public information requests involving regulated entities.
13. Legal opinions related to the processing of personal data and sensitive personal data.

Representative Matters

Corteva Agriscience (2020). We assisted in drafting and implementing personal data management and protection policies in accordance with applicable Mexican regulations for the company and its processors under a uniform data processing framework. We also issued legal opinions regarding specific issues and legal gaps related to the processing of sensitive personal data in particular situations, helping ensure compliance with applicable law.

SIG Combibloc (2021). We assisted in drafting and implementing personal data management and protection policies in accordance with applicable Mexican regulations. We conducted a gap analysis, drafted a privacy notice compliance manual, and trained the Human Resources department to process personal data in accordance with the company’s internationally harmonized policies. We also conduct annual reviews of their policies and procedures to maintain ongoing legal compliance.

BorgWarner (2023). We assisted in adapting the company’s personal data management and protection policies specifically for the various data subjects whose personal data is transferred from the company’s headquarters in Germany. We developed a contingency plan and a privacy notice user manual, and trained more than 30 delegates responsible for processing personal data in accordance with the company’s internationally harmonized policies.